T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/dispatch.py:52- Finding
Remote-command authorization marker is detected but not enforced
- Content
View full analysis
- Remediation
View remediation
Security audit
Remote Dispatch — 多端远程协同
Security checks for vulnerabilities and agentic risk
Overview
This remote-desktop skill discloses sensitive control features, but its parser can emit screen, clipboard, open-target, and window actions from broad chat phrases without enforcing the documented remote marker or confirmations.
Install only if you control the QQBot channel and downstream computer-use executor, and only after adding strict sender authentication, requiring the [远程] prefix, using an explicit command grammar, confirming screenshots/clipboard/window-close actions, and restricting what URLs, apps, and files can be opened.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dispatch.py:136- Finding
Window-closing action bypasses the documented secondary-confirmation requirement
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior includes sensitive clipboard read/write and remote data return paths that are not cleanly bounded in the declared purpose, while other claimed capabilities are only partially implemented. This mismatch is dangerous because reviewers and users may underestimate the skill's ability to exfiltrate local data or overtrust its safety model, especially for remote desktop control triggered from a messaging channel.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly supports taking screenshots and reading clipboard contents, then sending the results back over QQ, but it does not present a strong user-facing warning or trust boundary for that exfiltration path. Because screenshots and clipboard data often contain secrets, tokens, personal messages, or documents, transmitting them through a remote chat channel materially increases confidentiality risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language command model allows a remote requester to obtain screen contents and clipboard data through a chat interface, creating a straightforward exfiltration channel for sensitive local information. The context makes this more dangerous, not less, because the skill's stated purpose is remote desktop dispatch from a phone to a computer, which normalizes exactly the kind of data exposure attackers seek.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These example commands directly instruct the system to reveal clipboard contents and current on-screen activity to the remote requester. Providing such examples operationalizes data exfiltration and makes misuse easier, especially if command parsing is permissive or the QQ channel is compromised or spoofed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Remote screenshot capture can collect everything visible on the desktop, including private chats, documents, MFA prompts, and credentials, yet this action is emitted automatically from parsed message text. In a remote-dispatch skill, that context makes the issue more dangerous because the whole purpose is cross-device control, increasing the likelihood of privacy-invasive use or abuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill exposes remote clipboard reading and turns a chat message into a desktop data-exfiltration action without any authentication, consent, or sensitivity warning. Clipboard contents commonly include passwords, tokens, personal messages, and API keys, so this can leak highly sensitive data immediately.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes shell-capable command execution via Python invocations and desktop-control actions, but it declares no explicit tool scope or permission boundaries. In a remote-dispatch context, missing scope declarations increase the chance that an agent can invoke broader local capabilities than users expect, including opening files, reading clipboard contents, or triggering desktop actions from chat messages.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example triggers use broad everyday phrases like asking to open apps, close windows, or check current activity, which could be matched accidentally or by an untrusted sender. In a remote-control skill, ambiguous natural-language triggering raises the risk of unintended desktop actions and silent disclosure of screenshots or clipboard contents.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The usage section normalizes remote disclosure workflows for screenshots and clipboard contents, which lowers operator caution and encourages unsafe defaults. Even if presented as convenience features, these examples establish a pattern of transmitting sensitive local state over chat without strong safeguards.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The top-level documentation states support for '剪贴板', and the command map includes a 'clipboard_write' command at L030, implying write support. However, main() has no branch for 'clipboard_write', so such requests fall into the '未实现的指令' path instead of performing the documented action.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
User-facing descriptions, command triggers, and runtime messages are primarily in Chinese, and the command vocabulary is built around Chinese phrases. There is no indication that users can select their preferred language or that the locale restriction is explicitly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The open action accepts arbitrary remote targets and converts user-controlled text into a system action, enabling opening untrusted URLs, local files, or applications. While this file itself only emits JSON, in the intended computer-use pipeline it can trigger navigation to phishing pages, launch risky apps, or interact with sensitive local resources.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes the skill as converting remote commands into desktop actions including '文件操作', but the implemented command set only covers screenshots, search, clipboard access, opening targets, and window actions. No file-oriented command parsing or execution path exists in this file, creating a clear description-to-behavior mismatch.
- Content